Docker Security

2.

Securing the Host System

2.1.

Host Operating System Security

2.1.1.

Choosing a Hardened OS

2.1.2.

OS Hardening Guidelines

2.1.3.

Disabling Unnecessary Services

2.1.4.

Host Firewall Configuration

2.1.5.

System Updates and Patching

2.2.

Host Kernel Hardening

2.2.1.

Using a Container-Optimized OS

2.2.1.1.

Features of Container-Optimized OSes

2.2.1.2.

Popular Container-Optimized Distributions

2.2.1.3.

Performance and Security Benefits

2.2.2.

Regular Kernel Patching and Updates

2.2.2.1.

Patch Management Strategies

2.2.2.2.

Automated Update Tools

2.2.2.3.

Testing and Validation

2.2.3.

Kernel Security Modules

2.2.3.1.

2.2.3.1.1.

Profile Management

2.2.3.1.2.

Policy Enforcement

2.2.3.1.3.

Custom Profile Creation

2.2.3.2.

2.2.3.2.1.

Modes and Configuration

2.2.3.2.2.

2.2.3.2.3.

Troubleshooting SELinux Issues

2.2.3.3.

2.2.3.3.1.

Default vs Custom Profiles

2.2.3.3.2.

System Call Filtering

2.2.3.3.3.

Profile Development

2.3.

Securing Docker-related Files and Directories

2.3.1.

Filesystem Permissions for Docker Directories

2.3.1.1.

Setting Correct Ownership and Permissions

2.3.1.2.

Protecting Sensitive Data

2.3.1.3.

Directory Structure Security

2.3.2.

Auditing Docker Socket Access

2.3.2.1.

Risks of Docker Socket Exposure

2.3.2.2.

Restricting Access to docker.sock

2.3.2.3.

Socket Permission Management

2.3.3.

Configuration File Security

2.3.3.1.

Daemon Configuration Protection

2.3.3.2.

Certificate and Key Management

2.3.3.3.

Backup and Recovery

2.4.

User Access Control on the Host

2.4.1.

Managing the Docker Group

2.4.1.1.

Risks of Group Membership

2.4.1.2.

Best Practices for Group Management

2.4.1.3.

Alternative Access Methods

2.4.2.

Rootless Mode for Docker

2.4.2.1.

Benefits and Limitations

2.4.2.2.

Configuration Steps

2.4.2.3.

Troubleshooting Rootless Mode

2.4.3.

Sudo Configuration for Docker

2.4.3.1.

Restricted Sudo Access

2.4.3.2.

Command Limitations

2.4.3.3.

Audit Trail Management

2.5.

Host Vulnerability Scanning

2.5.1.

Host-Based Security Scanners

2.5.2.

Integrating Scanning into Maintenance Routines

2.5.3.

Vulnerability Assessment Tools

2.5.4.

Remediation Planning

Previous

1. Introduction to Container Security

Go to top

Next

3. Hardening the Docker Daemon